Privacy Policy

We collect information you provide directly and automatically when using Ask Aydo. This section details what data we collect and why.

We use your data exclusively to provide Ask Aydo's services:

We retain your data only as long as necessary to provide the service and to comply with legal obligations:

Documents and Account Data:

• While your account is active, your documents are retained so you can access them at any time
• Cancelling or downgrading a paid subscription does not delete your data - your account moves to the Starter plan and your documents are retained
• When you delete your account, your documents and personal data are removed from our active systems within 30 days. Encrypted database backups taken before deletion are retained for up to 7 days for disaster-recovery purposes, and file-storage backups for up to 90 days, after which they are automatically overwritten and unrecoverable
• We may close and delete accounts after a prolonged period of inactivity, after giving you advance notice

Fraud and Abuse Prevention:

• For fraud and abuse prevention purposes, we maintain a one-way cryptographic hash of a unique identifier associated with your WhatsApp account, stored separately from your documents and account profile
• This hashed identifier cannot be reversed to reveal your underlying account details and is used solely for fraud and abuse prevention - not for any other purpose
• It is retained for as long as necessary for fraud and abuse prevention purposes, which may extend beyond deletion of your account and documents
• We keep a tamper-evident audit log of actions taken on an account for a minimum of five years, as a security and accountability record. Entries survive account deletion by design; they record what was done and when, not the contents of your documents

Logs and Analytics:

• Aggregated, anonymized usage data may be retained to operate and improve the service
• Operational, error, and security logs are retained for a limited period for debugging, security, and compliance

Legal and Compliance Data:

• Payment and transaction records are retained as required by applicable tax and accounting law
• Records required for legal compliance are retained for as long as the law requires

You have rights regarding your personal data under the DPDP Act and other applicable privacy laws:

Access Rights:

• Request a copy of all personal data we hold about you
• View document metadata and AI-generated classifications
• Access your account activity and usage history
• Download your data in a portable format

Correction and Update Rights:

• Correct inaccurate personal information in your account
• Update document tags and classifications
• Modify emergency contact information
• Change subscription and billing details

Deletion Rights (Right to be Forgotten):

• Delete individual documents from your document library
• Request complete account deletion with data purge
• Remove specific personal information from our systems
• Opt out of non-essential data processing

Account deletion purges your documents and personal data as described above; it does not include the hashed fraud and abuse prevention identifier described under Data Retention Policies, which we retain as a legitimate security interest.

Data Portability:

• Export all documents in original formats
• Download structured data (metadata, tags, search history)
• Transfer data directly to another service (where technically feasible)

How to Exercise Your Rights: Contact us at privacy@askaydo.ai or use the data management tools in your account settings. We respond to requests within 30 days and verify your identity before processing.

We share your data only in limited circumstances and never sell your personal information:

Service Providers:

• Cloud infrastructure and hosting providers for secure storage
• Third-party AI providers for document OCR, classification, and content embeddings
• Our payment processor for subscription billing
• Email service providers for account notifications
• Security monitoring services for threat detection
• Website analytics providers to understand aggregate site usage (see Section 7)

WhatsApp Integration:

• WhatsApp Business API for message delivery
• Messages are end-to-end encrypted by WhatsApp
• We only access message content you send to our service
• WhatsApp's privacy policy also applies to messaging interactions

Legal Requirements:

• Court orders, subpoenas, or legal process
• Law enforcement requests with proper legal authority
• Protection of our rights, property, or safety
• Prevention of fraud or illegal activities

Emergency Access (where enabled on your plan):

• Designated emergency contacts after prolonged inactivity
• Verification process required before access is granted
• Limited to documents you've specifically designated for emergency access

Third-Party Service Providers: We use third-party service providers to operate the service.

For the current, named list of the sub-processors handling your data, see our Sub-processors page. That list is kept separate from this policy's version so that adding or replacing a provider - which does not change the categories of data collected, the purposes, or your rights - never triggers a re-acceptance prompt (see Notice of Material Changes in the DPDP Act section below).

Your data may be processed in more than one country. Where we transfer personal data across borders, we rely on legally recognised safeguards such as contractual protections, encryption, and other mechanisms permitted under applicable privacy law.

Processing Locations:

• Documents uploaded by Indian users are stored in India by default
• AI processing may occur in other regions; see the DPDP Act section below for details
• Backup and disaster recovery may occur across jurisdictions with appropriate protections

Your Rights: You may request information about where your data is processed and, where legally permitted, object to transfers to specific countries.

We use minimal tracking technologies, primarily for essential service functions and security:

Essential Cookies:

• Authentication tokens to keep you logged in
• Session management for secure interactions
• Security cookies to prevent fraud and attacks
• Load balancing for optimal performance

Functional Cookies:

• User preferences and settings
• Language and region preferences
• Accessibility settings

Analytics:

• Aggregated usage statistics (anonymized) via Google Analytics - no names, email addresses, or document content are ever sent to Google. See Google's Privacy Policy for how Google handles this data
• Performance monitoring and error tracking

Your Choices: Analytics cookies load only after you accept them in our cookie banner; declining or later revoking consent (via your browser settings) stops all analytics collection. Essential cookies cannot be disabled as they are required for the service to function.

We maintain security measures and have clear procedures for handling security incidents:

Detection and Response:

• Continuous monitoring and alerting on our systems
• Incident response procedures activated on detection
• Analysis to determine the scope and impact of an incident
• Containment and remediation as quickly as possible

User Notification: If a breach is likely to affect you, we notify you without undue delay through channels such as email, WhatsApp, and in-app notifications, with a clear explanation of what happened and what data was affected.

Regulatory Reporting:

• We notify the Data Protection Board of India and affected users within the timelines prescribed by the DPDP Act and its Rules
• We notify other regulators where required by applicable law
• We cooperate with law enforcement where appropriate

Remediation Support:

• Clear guidance on protective steps affected users can take
• A dedicated channel for breach-related questions
• Regular updates on investigation progress

For privacy-related questions, requests, or complaints, you can contact us at the addresses below. We respond to privacy requests within 30 days, or sooner where applicable law requires.

Data Protection / Grievance Officer:

• Email: privacy@askaydo.ai

Legal & Registered Office:

Data Protection Authority: If your concern is unresolved, you may lodge a complaint with the Data Protection Board of India, or with your local data protection authority where applicable.

Ask Aydo is intended only for individuals aged 18 or older. We do not knowingly collect personal data from anyone under 18.

If we become aware that we have collected personal data from a person under 18, we will delete the account and the associated data. If you believe a minor has provided us with personal data, contact us at privacy@askaydo.ai.

We use AI systems, including third-party AI providers operating under data processing agreements, to process your documents for OCR, classification, content analysis, and query processing. Document content is transmitted to these providers solely to provide service features and is not retained by them beyond what is necessary for processing.

Automated Decisions:

• Document rejection: Non-documents are automatically excluded
• PII detection and protection: Sensitive information is automatically identified and protected
• Security scanning: Malicious files are automatically quarantined
• Content filtering and categorization based on document type

Your Rights:

• Right to request human review of automated decisions affecting you
• Ability to correct or dispute AI-generated classifications
• Access to explanation of how automated decisions are made
• Option to opt out of optional AI features

Your documents are not used to train, fine-tune, or benchmark any AI model. Aggregated, anonymized usage patterns may be used to improve our service; you may opt out of this processing.

We implement industry-standard security measures to protect your documents and personal data:

• AES-256 encryption for data at rest; strict TLS encryption in transit
• Continuous monitoring and alerting on our systems
• Access to user data is not permitted by default; any access for customer support is logged for audit purposes

For detailed information about our security infrastructure and trust commitments, visit our Trust & Security page.

We comply with India's Digital Personal Data Protection Act, 2023, which is our primary data-protection framework (see the section below). Where other privacy laws apply to you - such as the GDPR in the European Union or the CCPA in California - we honour the rights and obligations they grant.

For international data transfers, we rely on encryption and other safeguards permitted under applicable privacy law.

Ask Aydo is a data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act). This section outlines our obligations and your rights as a data principal.

Our Obligations:

• We process personal data only for lawful purposes with your free, informed, specific, and unconditional consent
• We maintain this privacy notice describing data collected, processing purposes, and your rights
• We notify the Data Protection Board of India and affected data principals of personal data breaches within the timeline prescribed by the DPDP Rules
• We appoint a Data Protection Officer and provide a grievance redressal mechanism
• We do not transfer personal data of Indian users to jurisdictions notified as restricted by the Central Government

Your Rights as a Data Principal:

• Right of Access: Obtain a summary of personal data we hold and processing activities
• Right of Correction and Erasure: Correct inaccurate data or request deletion where processing is no longer necessary
• Right to Withdraw Consent: Withdraw your consent at any time, with the same ease as giving it, by deleting your account - ask Aydo directly in conversation, or email privacy@askaydo.ai. Since all of our processing exists solely to run your own document library - there is no secondary use like advertising or profiling to separately opt out of - withdrawing consent and deleting your account are the same action. This purges your documents and personal data as described under Data Retention Policies; it does not reach the hashed fraud-prevention identifier or audit-log entries, both of which are retained on separate lawful bases as set out under Data Retention Policies
• Right to Grievance Redressal: Lodge a complaint with our Data Protection Officer; escalate to the Data Protection Board of India if unresolved within 30 days
• Right to Nominate: Designate a nominee to exercise your data rights in case of death or incapacity

Data Residency (India):

• Documents uploaded by Indian users are stored in India by default
• AI processing (OCR, classification) may occur outside India with your consent; extracted metadata is returned and stored in India
• We will comply with any data localization directions issued by the Central Government

Aadhaar Numbers: When you send us an Aadhaar card, we do not keep the number as data: we record only the last four digits. The full number is not written to our database, our search index, or the text we extract from the document. This is a data-minimisation decision under the DPDP Act: we retain only what the service actually needs.

To be clear about what this does and does not cover: the document you upload is stored as you sent it, so any number printed on the card itself remains visible in that file. You can view or delete it at any time, and deleting it removes the extracted details with it.

Notice of Material Changes:A change to the categories of data we collect, the purposes we process it for, or how you exercise your rights is a material change - it bumps this policy's version and prompts you to re-accept the next time you message Aydo on WhatsApp. Adding or replacing a service provider (see the sub-processors list linked above), wording clarifications, and contact-detail updates are not material changes and do not require re-acceptance.

For DPDP-specific complaints, contact our Data Protection Officer at privacy@askaydo.ai.